@friggframework/core 2.0.0--canary.685.a13fdab.0 → 2.0.0--canary.679.a2bcc2f.0

package/management-api/v2/dependencies.js

@@ -29,18 +29,13 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
         getEntityTypeRegistry,
         getEntityTypeDefinitions,
     } = require('../../modules/entity-type-registry');
-    const { createScopePolicy } = require('../../modules/scope-policy');
-    const {
-        AuthorizeEntityForUser,
-    } = require('../../modules/use-cases/authorize-entity-for-user');
-    const {
-        ResolveIntegrationOwnership,
-    } = require('../../integrations/use-cases/resolve-integration-ownership');
+    const { GetUserFromBearerToken } = require('../../user/use-cases/get-user-from-bearer-token');
+    const { GetUserFromXFriggHeaders } = require('../../user/use-cases/get-user-from-x-frigg-headers');
+    const { GetUserFromAdopterJwt } = require('../../user/use-cases/get-user-from-adopter-jwt');
     const {
         AuthenticateWithSharedSecret,
     } = require('../../user/use-cases/authenticate-with-shared-secret');
     const { AuthenticateUser } = require('../../user/use-cases/authenticate-user');
-    const { buildUserAuthentication } = require('../../user/create-user-authentication');
     const { CreateIntegration } = require('../../integrations/use-cases/create-integration');
     const { UpdateIntegration } = require('../../integrations/use-cases/update-integration');
     const {
@@ -92,11 +87,6 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
         appDefinition.entityTypeRegistry ??
         getEntityTypeRegistry(appDefinition);
     const moduleDefinitions = getEntityTypeDefinitions(registry);
-    // Ownership by scope (ADR-056 §3): one object every use case asks.
-    const scopePolicy = createScopePolicy({
-        ownership: appDefinition.ownership,
-        entityTypeRegistry: registry,
-    });
 
     const moduleRepository = createModuleRepository();
     const integrationRepository = createIntegrationRepository();
@@ -105,7 +95,9 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
     const authorizationSessionRepository = createAuthorizationSessionRepository();
 
     const authenticateUser = new AuthenticateUser({
-        ...buildUserAuthentication({ userConfig, userRepository }),
+        getUserFromBearerToken: new GetUserFromBearerToken({ userRepository, userConfig }),
+        getUserFromXFriggHeaders: new GetUserFromXFriggHeaders({ userRepository, userConfig }),
+        getUserFromAdopterJwt: new GetUserFromAdopterJwt({ userRepository, userConfig }),
         authenticateWithSharedSecret: new AuthenticateWithSharedSecret(),
         userConfig,
     });
@@ -119,12 +111,10 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
     const getEntityModuleForUser = new GetEntityModuleForUser({
         moduleRepository,
         moduleDefinitions,
-        scopePolicy,
     });
     const getCredentialForUser = new credentialOps.GetCredentialForUserV2({
         credentialRepository,
         moduleRepository,
-        scopePolicy,
     });
     const getAuthorizationRequirements = new GetAuthorizationRequirements({
         moduleDefinitions,
@@ -138,22 +128,17 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
         moduleDefinitions,
         getAuthorizationRequirements,
         authorizationSessionRepository,
-        authorizeEntityForUser: new AuthorizeEntityForUser({
-            scopePolicy,
-            processAuthorizationCallback: new ProcessAuthorizationCallback({
-                moduleRepository,
-                credentialRepository,
-                integrationRepository,
-                moduleDefinitions,
-            }),
+        processAuthorizationCallback: new ProcessAuthorizationCallback({
+            moduleRepository,
+            credentialRepository,
+            integrationRepository,
+            moduleDefinitions,
         }),
         moduleRepository,
         credentialRepository,
-        scopePolicy,
     });
     const getOwnedIntegrationRecord = new integrationOps.GetOwnedIntegrationRecord({
         integrationRepository,
-        scopePolicy,
     });
     const getIntegrationInstanceForUser = new integrationOps.GetIntegrationInstanceForUser({
         getOwnedIntegrationRecord,
@@ -163,7 +148,6 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
     return {
         config,
         moduleDefinitions,
-        scopePolicy,
         repositories: {
             moduleRepository,
             integrationRepository,
@@ -179,7 +163,6 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
             integrationClasses,
             moduleFactory,
             moduleRepository,
-            scopePolicy,
         }),
         getPossibleIntegrations: new GetPossibleIntegrations({ integrationClasses }),
         createIntegrationForUser: new integrationOps.CreateIntegrationForUser({
@@ -188,11 +171,7 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
                 integrationClasses,
                 moduleFactory,
             }),
-            resolveIntegrationOwnership: new ResolveIntegrationOwnership({
-                moduleRepository,
-                integrationClasses,
-                scopePolicy,
-            }),
+            getEntityModuleForUser,
             integrationClasses,
         }),
         getIntegrationInstanceForUser,
@@ -224,10 +203,7 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
 
         // Entities
         getEntityModuleForUser,
-        listEntitiesForUser: new entityOps.ListEntitiesForUser({
-            moduleRepository,
-            scopePolicy,
-        }),
+        listEntitiesForUser: new entityOps.ListEntitiesForUser({ moduleRepository }),
         getEntityForUser: new entityOps.GetEntityForUser({ getEntityModuleForUser }),
         deleteEntityForUser: new entityOps.DeleteEntityForUser({
             getEntityModuleForUser,
@@ -239,15 +215,14 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
         refreshEntityOptionsForUser: new entityOps.RefreshEntityOptionsForUser({
             getEntityModuleForUser,
         }),
-        listEntityTypes: new ListEntityTypes({ entityTypeRegistry: registry, scopePolicy }),
-        getEntityType: new GetEntityType({ entityTypeRegistry: registry, scopePolicy }),
+        listEntityTypes: new ListEntityTypes({ entityTypeRegistry: registry }),
+        getEntityType: new GetEntityType({ entityTypeRegistry: registry }),
         getAuthorizationRequirements,
 
         // Credentials
         listCredentialsForUser: new credentialOps.ListCredentialsForUser({
             credentialRepository,
             moduleRepository,
-            scopePolicy,
         }),
         getCredentialForUser,
         deleteCredentialForUser: new credentialOps.DeleteCredentialForUser({

package/management-api/v2/dto.js

@@ -13,20 +13,6 @@ const idOf = (value) => {
     return String(value);
 };
 
-/**
- * `{ scope, owner, organizationId, access }` (ADR-056 §3.4): whose a record is
- * and what the caller may do with it. Empty when the use case did not say.
- */
-function tenancyFields(tenancy) {
-    if (!tenancy) return {};
-    return {
-        scope: tenancy.scope,
-        owner: tenancy.owner,
-        organizationId: tenancy.organizationId ?? null,
-        access: tenancy.access,
-    };
-}
-
 /** An entity (connected account). */
 function toEntityDto(entity) {
     const credential =
@@ -44,7 +30,6 @@ function toEntityDto(entity) {
             typeof credential?.authIsValid === 'boolean'
                 ? credential.authIsValid
                 : null,
-        ...tenancyFields(entity.tenancy),
     };
 }
 
@@ -57,7 +42,6 @@ function toIntegrationDto(integration) {
         config: integration.config ?? {},
         version: integration.version ?? null,
         messages: integration.messages ?? {},
-        ...tenancyFields(integration.tenancy),
     };
 }
 
@@ -75,8 +59,6 @@ const CREDENTIAL_METADATA = new Set([
     'type',
     'entityIds',
     'status',
-    // Added by the credential use cases (ADR-056 §3.4); never provider data.
-    'tenancy',
 ]);
 
 /**
@@ -128,13 +110,11 @@ function maskCredential(credential) {
         entityCount: entityIds.length,
         createdAt: toIso(credential.createdAt),
         updatedAt: toIso(credential.updatedAt),
-        ...tenancyFields(credential.tenancy),
         data,
     };
 }
 
 module.exports = {
-    tenancyFields,
     toEntityDto,
     toIntegrationDto,
     maskCredential,

package/management-api/v2/handlers/authorization.js

@@ -63,7 +63,6 @@ function createAuthorizationHandlers(useCases) {
                 data: body.data,
                 step,
                 sessionId,
-                scope: optionalString(body.scope, 'scope'),
             });
             res.json(toAuthorizationResponse(result));
         },

package/management-api/v2/handlers/credentials.js

@@ -1,5 +1,4 @@
 const { maskCredential } = require('../dto');
-const { parseListFilters } = require('../request');
 
 /** Management API v2 credential handlers, keyed by operationId. */
 function createCredentialHandlers(useCases) {
@@ -7,11 +6,8 @@ function createCredentialHandlers(useCases) {
         useCases;
 
     return {
-        async listCredentials(req, res, user) {
-            const credentials = await listCredentialsForUser.execute(
-                user,
-                parseListFilters(req.query)
-            );
+        async listCredentials(_req, res, user) {
+            const credentials = await listCredentialsForUser.execute(user);
             res.json({ credentials: credentials.map(maskCredential) });
         },
 

package/management-api/v2/handlers/entities.js

@@ -1,5 +1,5 @@
 const { toEntityDto } = require('../dto');
-const { objectBody, parseStep, parseListFilters } = require('../request');
+const { objectBody, parseStep } = require('../request');
 
 /** Management API v2 entity and entity-type handlers, keyed by operationId. */
 function createEntityHandlers(useCases) {
@@ -16,20 +16,17 @@ function createEntityHandlers(useCases) {
     } = useCases;
 
     return {
-        async listEntities(req, res, user) {
-            const entities = await listEntitiesForUser.execute(
-                user,
-                parseListFilters(req.query)
-            );
+        async listEntities(_req, res, user) {
+            const entities = await listEntitiesForUser.execute(user);
             res.json({ entities: entities.map(toEntityDto) });
         },
 
-        async listEntityTypes(_req, res, user) {
-            res.json({ types: await listEntityTypes.execute({ user }) });
+        async listEntityTypes(_req, res) {
+            res.json({ types: await listEntityTypes.execute() });
         },
 
-        async getEntityType(req, res, user) {
-            res.json(await getEntityType.execute(req.params.entityType, { user }));
+        async getEntityType(req, res) {
+            res.json(await getEntityType.execute(req.params.entityType));
         },
 
         // Describes a step's requirements without starting an authorization

package/management-api/v2/handlers/integrations.js

@@ -1,5 +1,5 @@
 const { toIntegrationDto } = require('../dto');
-const { objectBody, optionalString, parseListFilters } = require('../request');
+const { objectBody, optionalString } = require('../request');
 
 /**
  * Management API v2 integration handlers, keyed by registry operationId.
@@ -27,11 +27,8 @@ function createIntegrationHandlers(useCases) {
         );
 
     return {
-        async listIntegrations(req, res, user) {
-            const integrations = await getIntegrationsForUser.execute(
-                user,
-                parseListFilters(req.query)
-            );
+        async listIntegrations(_req, res, user) {
+            const integrations = await getIntegrationsForUser.execute(user.getId());
             res.json({ integrations: integrations.map(toIntegrationDto) });
         },
 

package/management-api/v2/request.js

@@ -1,5 +1,4 @@
 const Boom = require('@hapi/boom');
-const { LIST_OWNERS } = require('../../modules/scope-visibility');
 
 /** The JSON body as an object, or a 400 VALIDATION_ERROR. */
 function objectBody(req) {
@@ -52,34 +51,4 @@ function optionalString(value, name) {
     return value;
 }
 
-const LIST_SCOPES = ['individual', 'organization'];
-
-/**
- * `?scope=individual|organization` and `?owner=me|org` on a list (ADR-056
- * §3.4). Anything else is a 400.
- */
-function parseListFilters(query = {}) {
-    const scope = optionalString(query.scope, 'scope');
-    const owner = optionalString(query.owner, 'owner');
-    if (scope !== undefined && !LIST_SCOPES.includes(scope)) {
-        throw Boom.badRequest(`scope must be one of ${LIST_SCOPES.join(', ')}`, {
-            code: 'VALIDATION_ERROR',
-            details: { field: 'scope' },
-        });
-    }
-    if (owner !== undefined && !Object.hasOwn(LIST_OWNERS, owner)) {
-        throw Boom.badRequest('owner must be me or org', {
-            code: 'VALIDATION_ERROR',
-            details: { field: 'owner' },
-        });
-    }
-    return { scope, owner };
-}
-
-module.exports = {
-    objectBody,
-    requireFields,
-    parseStep,
-    optionalString,
-    parseListFilters,
-};
+module.exports = { objectBody, requireFields, parseStep, optionalString };

package/modules/index.js

@@ -8,11 +8,6 @@ const {
     getEntityTypeRegistry,
     EntityRegistryError,
 } = require('./entity-type-registry');
-const {
-    resolveScope,
-    listBindingScopes,
-    OwnershipConfigError,
-} = require('./entity-scope');
 
 module.exports = {
     ApiKeyRequester,
@@ -23,7 +18,4 @@ module.exports = {
     ModuleFactory,
     getEntityTypeRegistry,
     EntityRegistryError,
-    resolveScope,
-    listBindingScopes,
-    OwnershipConfigError,
 };

package/modules/repositories/module-repository-documentdb.js

@@ -3,14 +3,12 @@ const {
     toObjectId,
     fromObjectId,
     findMany,
-    findManyDrained,
     findOne,
     insertOne,
     updateOne,
     deleteOne,
 } = require('../../database/documentdb-utils');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
-const { entityNotFoundError } = require('./entity-not-found');
 const { DocumentDBEncryptionService } = require('../../database/documentdb-encryption-service');
 
 /**
@@ -35,11 +33,11 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
     async findEntityById(entityId) {
         const objectId = toObjectId(entityId);
         if (!objectId) {
-            throw entityNotFoundError(entityId);
+            throw new Error(`Entity ${entityId} not found`);
         }
         const doc = await findOne(this.prisma, 'Entity', { _id: objectId });
         if (!doc) {
-            throw entityNotFoundError(entityId);
+            throw new Error(`Entity ${entityId} not found`);
         }
         const credential = await this._fetchCredential(doc.credentialId);
         return this._mapEntity(doc, credential);
@@ -78,29 +76,6 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
         return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || null));
     }
 
-    /**
-     * Find entities matching any of the owner/organization pairs, in one query.
-     * `organizationId: null` matches rows with no organization (a raw MongoDB
-     * `null` also matches a missing field). The caller (a use case) decides
-     * which pairs; this only runs them.
-     *
-     * @param {Array<{userId: string, organizationId: (string|null)}>} clauses
-     * @returns {Promise<Array>}
-     */
-    async findEntitiesByOwnership(clauses) {
-        if (!Array.isArray(clauses) || clauses.length === 0) return [];
-        // Drained: a list can hold more than the first cursor batch (~101).
-        const docs = await findManyDrained(this.prisma, 'Entity', {
-            $or: clauses.map(({ userId, organizationId }) => ({
-                userId: toObjectId(userId),
-                organizationId:
-                    organizationId === null ? null : toObjectId(organizationId),
-            })),
-        });
-        const credentialMap = await this._fetchCredentialsBulk(docs.map((doc) => doc.credentialId));
-        return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || null));
-    }
-
     async unsetCredential(entityId) {
         const objectId = toObjectId(entityId);
         if (!objectId) return false;
@@ -140,14 +115,7 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
         );
     }
 
-    /**
-     * @param {Object} entityData
-     * @param {{organizationId?: (string|null)}} [tenancy] - the organization the entity
-     *   belongs to (ADR-056 §3.6). A separate argument, not a field of `entityData`,
-     *   because `entityData` carries provider fields and one named `organizationId`
-     *   must not be taken for ours.
-     */
-    async createEntity(entityData, tenancy = {}) {
+    async createEntity(entityData) {
         const {
             user,
             userId,
@@ -165,7 +133,6 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
             name: name ?? null,
             moduleName: moduleName ?? null,
             externalId: externalId ?? null,
-            organizationId: toObjectId(tenancy.organizationId) || null,
             data: dynamicData,
         };
         const insertedId = await insertOne(this.prisma, 'Entity', document);
@@ -280,9 +247,8 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
             const objectIds = ids.map(id => toObjectId(id)).filter(Boolean);
             if (objectIds.length === 0) return new Map();
 
-            // Raw read to bypass the Prisma encryption extension. Drained:
-            // more ids than the first cursor batch must all come back.
-            const rawCredentials = await findManyDrained(this.prisma, 'Credential', {
+            // Use raw findMany to bypass Prisma encryption extension
+            const rawCredentials = await findMany(this.prisma, 'Credential', {
                 _id: { $in: objectIds }
             });
 
@@ -363,30 +329,19 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
         if (filter.name) query.name = filter.name;
         if (filter.moduleName) query.moduleName = filter.moduleName;
         if (filter.externalId) query.externalId = filter.externalId;
-        // `null` means "no organization"; absent means "any". A raw MongoDB
-        // `{ field: null }` matches both a null value and a missing field.
-        if (filter.organizationId !== undefined) {
-            query.organizationId =
-                filter.organizationId === null
-                    ? null
-                    : toObjectId(filter.organizationId);
-        }
         return query;
     }
 
     _mapEntity(doc, credential) {
         const dynamicData = doc?.data || {};
         return {
-            // First, so no stored provider field can replace a column below
-            // (identity, owner or organization decide who sees the entity).
-            ...dynamicData,
             id: fromObjectId(doc?._id),
             credential,
             userId: fromObjectId(doc?.userId),
             name: doc?.name ?? null,
             externalId: doc?.externalId ?? null,
             moduleName: doc?.moduleName ?? null,
-            organizationId: fromObjectId(doc?.organizationId) ?? null,
+            ...dynamicData,
         };
     }
 }

package/modules/repositories/module-repository-interface.js

@@ -67,21 +67,6 @@ class ModuleRepositoryInterface {
         );
     }
 
-    /**
-     * Find entities matching any of the owner/organization pairs, in one query
-     * (ADR-056 §3.6). `organizationId: null` matches rows with no organization.
-     * Which pairs is decided by the caller (modules/entity-scope.js), not here.
-     *
-     * @param {Array<{userId: string|number, organizationId: (string|number|null)}>} clauses
-     * @returns {Promise<Array>} Array of entity objects
-     * @abstract
-     */
-    async findEntitiesByOwnership(clauses) {
-        throw new Error(
-            'Method findEntitiesByOwnership must be implemented by subclass'
-        );
-    }
-
     /**
      * Unset credential from entity
      *
@@ -125,13 +110,11 @@ class ModuleRepositoryInterface {
     /**
      * Create a new entity
      *
-     * @param {Object} entityData - Entity data (provider fields included)
-     * @param {{organizationId?: (string|number|null)}} [tenancy] - the organization
-     *   the entity belongs to (ADR-056 §3.6), kept apart from `entityData`
+     * @param {Object} entityData - Entity data
      * @returns {Promise<Object>} Created entity object
      * @abstract
      */
-    async createEntity(entityData, tenancy) {
+    async createEntity(entityData) {
         throw new Error('Method createEntity must be implemented by subclass');
     }